Method and apparatus for augmented pilot operations of fly-by-wire vehicles

ABSTRACT

A system for augmented pilot operations is provided to perform checks and balances between navigable systems and a plurality of controlling parties of a Fly-By-Wire vehicle. A ground based control system having at least one of manual controls and an autonomous piloting system, an electronic communication system including at least one of an onboard communication system, a ground based communication system, and a programmable interface for inter party communication. An on board flight control system including at least one of a primary power unit, manual flight controls, and a programmable flight management system may be provided. An onboard auxiliary navigation system including at least one of an auxiliary power control unit, a ground operated control/navigation unit, a physical barrier may prevent manual override from within the plane or cockpit, and an assignment device. A disagreement detection system may be configured to detect unauthorized use of the Fly-By-Wire vehicle.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 62/074,140 filed Nov. 3, 2014, the entire contents of which arehereby incorporated by reference.

BACKGROUND

Existing commercial aircraft and other Fly-By-Wire vehicles have beendemonstrated to be vulnerable to terrorist attacks, autopilotmalfunctions, unauthorized usurpation of control, and use by authorizedpilots for unauthorized uses. A multitude of scenarios may arise thatsubject pilots and passengers within the vehicle and other third partiesto vulnerabilities. The multitude of scenarios that may cause drasticfailure of a vehicle indicate the need for a customizable system ofchecks and balances between persons and systems authorized to controlsaid vehicles.

The present invention may provide a customizable system that utilizesmanual systems and methods for navigation of a Fly-By-Wire vehicle inconjunction with other relevant systems and methods for navigation thatare automated. In an exemplary embodiment the invention may utilize ahost of electronic systems to reduce the multitude of securityvulnerabilities that passengers, pilots, crewmembers, cargo, and thirdparties are subjected to by existing aviation practices. A wide range ofvulnerabilities render singularly manual and singularly automatedcontrol systems unsafe, whether they are onboard the vehicle orcontrolled by an external ground based control source. For example, anonboard system may malfunction or a pilot or other unauthorizedcrewmember may usurp control of the vehicle for unauthorized uses.Additionally, complete reliance on ground based controls would subjectthe passengers to the vulnerabilities associated with a loss oftransmission, unauthorized electronic control of ground systems throughhacking, or authorized ground based controls intentionally using thevehicle for unauthorized purposes. Accordingly, the public would greatlybenefit by an invention that provides for a customizable system ofredundant checks and balances between manual and automated navigablecontrol systems.

SUMMARY

A system and method for the checks and balances between onboard andground based navigation systems for Fly-By-Wire (“FBW”) Vehicles may beprovided. Interactions between onboard manual and automated flightnavigation systems with ground based manual and automated flight controlsystems may be facilitated for augmented pilot operations of Fly-By-Wirevehicles.

A Fly-By-Wire system allows conventional cockpit controls to manipulateexternal flight surfaces by use of an electronic or digital transfersystem. The digital transfer system may include a processing componentwhich accepts the conventional manual control inputs from the pilot, andtransfers them into electronic signals which are then used to operateflight control surfaces used for navigation.

In one exemplary embodiment, the present invention may include a groundbased control system having at least one of manual controls and anautonomous piloting system, an electronic communication system ding atleast one of an onboard communication system, a ground basedcommunication system, and a programmable interface for inter partycommunication. An on board flight control system including at least oneof a primary power unit, manual flight controls, and a programmableflight management system may be provided. An onboard auxiliarynavigation system including at least one of an auxiliary power controlunit, a ground operated control/navigation unit, a physical barrier thatmay prevent manual override from within the plane or cockpit, and anassignment device. A disagreement detection system may be configured todetect unauthorized use of the Fly-By-Wire vehicle. The disagreementdetection system may additionally detect unauthorized use, and orattempts at use, of the FBW navigation controls in which an individualattempts to hack the FBW system through the planes on board networksystem. The planes onboard network system may be wireless or wired.

In further exemplary embodiments, the onboard FBW control systems of avehicle such as, for example, manual controls and autopilot controls,may be rendered powerless by a ground based command station in the eventof an emergency, and exclusive navigable control of said vehicle may bemaintained by a ground based command station. Once the on boardnavigable systems are rendered powerless by the ground based commandstation they may not be regained unless the ground based command stationreinstitutes power to the primary FBW control power unit. In the eventof a loss of transmission, the onboard autopilot may follow pre-ordainedflight paths, possibly to the closest airport for sate landing, asprogrammed by the Flight Management System. In the event the groundbased command station has been compromised, may be malfunctioning, ormay have lost control of the FBW vehicle by an improper usurpation ofonboard navigation systems, the onboard pilot, crew, or flightmanagement system may request an intervention. An intervention may beperformed by an apparatus that communicates the vehicle's distresssignal, thereby indicating the onboard pilots' need for an alternateground based control source. The intervention may not allow the onboardpilot to regain control of the vehicle, but may allow the groundoperated control sources to be monitored by the onboard pilot andsystems.

BRIEF DESCRIPTION OF THE FIGURES

Advantages of embodiments of the present invention will be apparent fromthe following detailed description of the exemplary embodiments. Thefollowing detailed description should be considered in conjunction withthe accompanying figures in which:

FIG. 1 shows an exemplary embodiment of onboard navigation components.

FIG. 2 shows an exemplary embodiment of a Switching System AssignmentDevice.

FIG. 3 shows an exemplary embodiment of a Ground Control OperationStation.

DETAILED DESCRIPTION

Aspects of the invention are disclosed in the following description andrelated drawings directed to specific embodiments of the invention.Alternate embodiments may be devised without departing from the spiritor the scope of the invention. Additionally, well-known elements ofexemplary embodiments of the invention will not be described in detailor will be omitted so as not to obscure the relevant details of theinvention. Further, to facilitate an understanding of the descriptiondiscussion of several terms used herein follows.

As used herein, the word “exemplary” means “serving as an example,instance or illustration.” The embodiments described herein are notlimiting, but rather are exemplary only. It should be understood thatthe described embodiment are not necessarily to be construed aspreferred or advantageous over other embodiments. Moreover, the terms“embodiments of the invention”, “embodiments” or “invention” do notrequire that all embodiments of the invention include the discussedfeature, advantage, or mode of operation.

Further, many of the embodiments described herein are described in termsof sequences of actions to be performed by, for example, elements of acomputing device. It should be recognized by those skilled in the artthat the various sequences of actions described herein can be performedby specific circuits (e.g. application specific integrated circuits(ASICs)) and/or by program instructions executed by at least oneprocessor. Additionally, the sequence of actions described herein can beembodied entirely within any form of computer-readable storage mediumsuch that execution of the sequence of actions enables the at least oneprocessor to perform the functionality described herein. Furthermore,the sequence of actions described herein can be embodied in acombination of hardware and software. Thus, the various aspects of thepresent invention may be embodied in a number of different forms, all ofwhich have been contemplated to be within the scope of the claimedsubject matter. In addition, for each of the embodiments describedherein, the corresponding form of any such embodiment may be describedherein as, for example, “a computer configured to” perform the describedaction.

Typical aircraft utilize a Fly-By-Wire system including a processingcomponent which accepts the conventional manual control inputs from thepilot electronically. Additionally, Fly-By-Wire systems help stabilizethe aircraft by normalizing the conventional manual input from the pilotwith automatic adjustment signals in order to prevent unintentionaloperation of the aircraft away from its best mode of performance. Insome exemplary embodiments, the present invention may utilize the dualnature of the Fly-By-Wire system's normalization and electronicinterface to provide a means of checks and balances between the onboardhuman and autopilot features by providing an additional apparatus topromote coordination with ground based human and autonomous pilotingcapabilities. Additionally a system of checks and balances betweennavigable systems and controlling parties of a Fly-By-Wire vehicle maybe provided.

In further exemplary embodiments, a method and apparatus of providingthe system of checks and balances by selecting from a multitude ofcontrol options, and assigning the appropriate control input based uponthe particular circumstances encountered may be provided. An apparatusmay be customized and programmed for specific uses and thresholds ofintervention between the various controlling inputs.

In some exemplary embodiments, the apparatus may include a ground basedcontrol system comprising manual controls and autonomous pilotingsystem(s); an electronic communication system comprising onboardcommunication system(s), ground based communication system(s), and aprogrammable interface for inter party communication. An on board flightcontrol system may include a primary power unit, manual flight controls,and a programmable flight management system. An onboard auxiliarynavigation system may include an auxiliary power control unit, a groundoperated control/navigation unit, a physical barrier which may preventmanual override from within the plane or cockpit, and an assignmentdevice. A disagreement detection system to detect unauthorized use of aFly-By-Wire vehicle as controlled by either the ground based controlsystem(s) or onboard control system(s).

In similar fashion the invention may utilize a method of monitoring FBWvehicles and intervening in the piloting of FBW vehicles according tothe following steps.

A ground based control and operation station (“GBCOS”) including manualcontrol mechanisms capable of remotely piloting FBW vehicles, and anautonomous piloting system that may be capable of remotely piloting FBWvehicles, may monitor FBW vehicles with the intention of preventingunauthorized use. In the event of an unauthorized use the GBCOS mayassume control of the Fly-By-Wire vehicle by means of a two waycommunication link that removes power from the cockpit controls, whichmay prevent the manual controls from communicating with the FBW computerprocessor. Simultaneously, the FBW computer processor may receivecontrolling inputs from the GBCOS via the onboard auxiliary navigationsystem and communication link. At this point the FBW computer processormay be controlled exclusively by a GBCOS. After the powering down of thecockpit controls and transferring exclusive piloting control to theauxiliary navigation system the GBCOS may navigate the plane by: manualcontrol mechanisms, autonomous control systems, or both.

In some exemplary embodiments of the aforementioned method, theapparatus may be used to transfer sole navigable authority to a GBCOSthat has previously been monitoring the vehicle. The onboard vehiclestabilization features and onboard flight management system may assistthe GBCOS.

In some exemplary embodiments a solution to the unauthorized entry orusurpation of FBW vehicle is disclosed. For example, in the event that aFBW vehicle's security may be compromised due to unknown alternateunauthorized entity. This entity may be, for example, an onboardpassenger capable of accessing the onboard networking system of the FBWvehicle. In the event control of a FBW vehicle is lost because of anunauthorized accessing of the FBW networking system, such as by hackinginto the network architecture through wireless or physical wires any ofthe following may happen. The disagreement detection system may notifythe piloting members of the airplane and the ground based controlstation. The ground based control station may then assume exclusivecontrol of the FBW navigation system by rendering all onboard pilotingsystems functionless. The onboard piloting systems may be renderedfunctionless by a ground based control and operation by removing thepower to the cockpit controls. Alternatively, if required, the groundbased control and operation station may remove the power to the entireFBW vehicle with the exception of critical life support infrastructure.The pilot may request an intervention of the FBW vehicle by utilizingthe intervention distress signal and a ground based control andoperation station may assume exclusive control. The processing componentof the FBW system may notify the pilot and ground based control andoperation station that it is receiving interference, or other electronicsignals, from a non-authenticated source. Additionally, in the event anymonitored FBW system, such as engine speed, vehicle speed and bearing,elevation abruptly changes the disagreement detection system will notifythe pilot and ground based control station.

In some exemplary embodiments of the system, the onboard passengercommunication, entertainment, and network systems are isolated from theonboard navigation systems. The navigable systems of the FBW vehicle arelimited to control from within the cockpit or alternatively from aground based control station. Additionally, a separate communicationsystem for onboard internet access and local onboard network access ismaintained. This first communication system is isolated from the two waycommunication system that a ground based control station may utilize tocontrol a FBW vehicle.

In some exemplary embodiments of the system the onboard flightmanagement system may only be programmed by an authorized authenticatedsource. The onboard pilot and the ground based control station may bothreview the programmed flight management system for accuracy and safetybefore the vehicle reaches a pre-determined speed and altitude. Afterthe vehicle exceeds the pre-determined speed and altitude the flightmanagement system may be programmed by the ground based control andoperation station exclusively. There is no means for any onboard systemto modify the programming of the flight management system.

In some exemplary embodiments of the system the flight managementsystem, disagreement protection system, communication system, FBWprocessing component, and the ground based control and operationstation, are protected by a firewall. The firewall may be used toauthenticate security credentials to prevent the unauthorized usurpationor modification of controls of the system.

In an exemplary embodiment a physical barrier may be provided to preventunauthorized usurpation of control of a FBW vehicle. For example, aPlexiglass panel, that only the pilot or other authorized individual mayrelease, is utilized to block access to the FBW vehicle's avionicssystem. Additionally, all circuit breakers on the FBW vehicle may have aphysical barrier to prevent authorized access to all circuit breakerswhich may cover all electrical control systems of said FBW vehicle.

Referring to FIG. 1, The first exemplary embodiment may be representedby a Block Diagram as shown in FIG. 1, which includes a vehicle with aFly-By-Wire System and Interface 102 that can control all of the majorFlight Control Systems and Surfaces 104 of the vehicle including but notlimited to; the throttle, wing flaps, control yoke, rudder, pedals, andlanding gear by Conventional Cockpit Controls 106. The ConventionalCockpit Controls 106 may be electrically powered by an InterruptiblePower Switch 112, that may be controlled by the Auxiliary NavigationSystem 108. The Auxiliary Navigation System 108, the Two WayCommunication Link 118, the Flight Management System 110, andIntervention Distress Switch 116, may be powered by a Non-InterruptiblePower Source 114. The Auxiliary Navigation System 108 may communicatewith a Ground Based Control and Operation Station 120. In the event theGround Based Control and Operation Station 120 intends to removeConventional Cockpit Control 106 of the Fly-By-Wire System Interface102, the Auxiliary Navigation System 108 may remove power to theConventional Cockpit Controls 106 by the Interruptible Power Switch 112.The intervention distress radio and switch 116 may be located in thecockpit or alternate locations on the airplane as would be understood bya person of ordinary skill in the art. The intervention distress radioand switch 116 may maintain power in the event the Conventional CockpitControls 106 loses power as a result of the Interruptible Power Switch112. The intervention distress radio and switch 116 may maintain powerand access to the Two Way Communication Link 118 at all times.

In further exemplary embodiments, a means may be provided for onboardflight members to request a controlling intervention in the event that aparticular GBCOS assumes control of the vehicle for an unauthorized useby utilization of a switching protocol. The switching protocol may allowthe onboard human pilot or crewmembers to maintain communication withmultiple GBCOS to further enhance security of the vehicle.

The method to initiate a switching of control may preferably beperformed by sending a distress signal to the particular GBCOS, analternate GBCOS, and/or a coordinated network of GBCOS's simultaneously.The distress signal may be interpreted by the GBCOS and respondingsignals may be interpreted by the Auxiliary Navigation System 108. Theparticular GBCOS that has assumed control may assign an alternate onsite control source for the vehicle. An alternate GBCOS may assumecontrol of the aircraft provided the auxiliary navigation systemapproves the switch, thereby removing control of the aircraft from theinitial GBCOS. The intervention may not allow the onboard pilot toregain control, but may allow the onboard crew to check and balance thespecific GBCOS that has assumed control of FBW vehicle. The GBCOS mayrelinquish control to the onboard navigation systems on an as neededbasis.

In some exemplary embodiments, an intervention may not occurautomatically. Rather, an intervention may be a calculated decision madeby the onboard auxiliary navigation system. The auxiliary navigationsystem may not transfer controlling authority of the aircraft untilappropriate. The auxiliary navigation system may rely on, but is notlimited to, the following when performing a safety assessment: thealtitude, the wind speed and direction, the proximity of other aircraft,the aircraft speed, or other factors as would be understood by a personof ordinary skill in the art. The Auxiliary Navigation system may beprogrammable for various detection parameters. In the event an onboardpilot or crewmember has requested multiple interventions, the onboardauxiliary navigation system may choose to ignore the distress signal. Inthe event of nearby terrain or other objects the auxiliary navigationsystem may not transfer navigable authority.

Referring now to FIG. 2, another exemplary embodiment may be representedby a block diagram depicting the Switching System. In the event that anOriginal Ground Control Assignee 202 has assumed control of the vehicleby utilizing the Auxiliary Navigation System 208, an onboard pilot orcrewmembers may request an intervention, for example, in the case of amalfunctioning signal or unauthorized ground control by the interventionDistress Radio and Switch 212. The intervention Distress Radio Switchmay send a signal to the Auxiliary Navigation System 208, which may thendetermine if it is appropriate to send a request to an Alternate GroundControl Source 216, by the Onboard Communication Transmitter 210. In theevent the Auxiliary Navigation System determines it is appropriate totransmit an Assignment Request 214 via the Communication Transmitter 210to an Alternate Ground Control Source 216, and an Alternate GroundControl Source has the resources to accept the request, a confirmationmay be sent to the Assignment Device 204. The Assignment Device 204,with the coordination of the Auxiliary Navigation System 208, may removethe Original Ground Control Assignee and may establish a secureconnection with the Alternate Ground Control Source 216.

In further exemplary embodiments, the system and method of the presentinvention may provide for efficient checks and balances between groundbased manual controls and autonomous operation controls. This may beachieved, for example, by utilizing additional Ground Based Control andOperation Stations that are in coordination. Additionally, a GBCOSComputing System may allow for time collection of data to promoteefficient traffic density and optimize taxi time between runways.Furthermore, the GBCOS Computing System may allow for one human operatorto potentially oversee the Autonomous Control of multiple aircraft,thereby reducing administrative costs.

Referring to FIG. 3, a further exemplary embodiment may be provided todefine the Ground Based Control and Operation Stations. Manual OperationControls 302, in coordination with Autonomous Operation Control(s) 304may be linked to the Computing System 306, and Ground Control AssignmentDevice 312. The Assignment Device and the computing system may worktogether in parallel to control the scope of control between theAutonomous Operation 304, and Manual Operation 302. The Ground BasedCommunication Receiver 314, may receive in Flight Data 310 in the eventthat the assignment device institutes a controlling protocol to eitherthe Autonomous Operation 304 or the Manual Operation 302, or both.Additionally the Ground. Based Communication Receiver may receive aRequest for Assignment 316 from an alternate source, such as a vehicleor alternate command station. The Ground Based Computing System 306 maydetermine if and when a request for assignment can be established. TheGround Based Computing System 306 may communicate controlling protocolwith the Auxiliary Navigation System 318 via the Ground BasedCommunication Transmitter 308. The Ground Based Computing Systemreceives in Flight Data 310 from the onboard two way communication linkof the vehicle. This information may be received by the CommunicationReceiver 310 and may relay this information to either the AutonomousOperation 304 or the Manual Operation 302, or both.

The foregoing description and accompanying figures illustrate theprinciples, preferred embodiments and modes of operation of theinvention. However, the invention should not be construed as beinglimited to the particular embodiments discussed above. Additionalvariations of the embodiments discussed above will be appreciated bythose skilled in the art.

Therefore, the above-described embodiments should be regarded asillustrative rather than restrictive. Accordingly, it should beappreciated that variations to those embodiments can be made by thoseskilled in the art without departing from the scope of the invention asdefined by the following claims.

1. An apparatus for augmented control of a fly-by-wire vehicle,comprising: a ground based control system including at least one ofmanual controls and an autonomous piloting system; an electroniccommunication system in communication with the ground based controlsystem and including at least one of onboard communication system, aprogrammable interface for inter party communication, and a ground basedcommunication; an on board flight control system in communication withthe electronic communication system and including at least one of aprimary power unit, manual flight controls, and a programmable flightmanagement system; an on board auxiliary navigation system incommunication with the on board flight control system and including atleast one of an auxiliary power control unit, a ground operatedcontrol/navigation unit, a physical barrier to prevent manual overridefrom within the plane or cockpit, and an assignment device; and adisagreement detection system configured to detect unauthorized use ofthe fly-by-wire vehicle, wherein the ground based control system, theelectronic communication system, the on board flight control system, theon board auxiliary navigation system, and the disagreement detectionsystem are in communication with one another.
 2. The apparatus of claim1, wherein at least one of the ground based control system, theelectronic communication system, the on board flight control system, theon board auxiliary navigation system, and the disagreement detectionsystem work in coordination to navigate the fly by wire vehicle.
 3. Theapparatus of claim 1, wherein at least one of the ground based controlsystem, the on board flight control system, and the on board auxiliarynavigation system, exclusively navigate the fly by wire vehicle.
 4. Theapparatus of claim 1, wherein a security verification is required tooperate at least one of the ground based control system, the electroniccommunication system, the on board flight control system, the on boardauxiliary navigation system, and the disagreement detection system. 5.The apparatus of claim 1, wherein the ground based control systemremoves power from manual flight controls of the fly-by-wire vehicle. 6.The apparatus of claim 1, wherein the ground based control systemremoves power from electric systems of a fly-by-wire vehicle with theexception of critical life support systems.
 7. The apparatus of claim 1,wherein the disagreement detection system communicates deviationsbetween pre-determined flight paths and, actual flight paths to at leastone of the ground based control system, and on board flight controlsystem.
 8. The apparatus of claim 1, wherein at least one entity orsystem onboard the fly-by-wire vehicle can request an intervention viaan intervention distress radio switch.
 9. The apparatus of claim 1,wherein the onboard electronic communication system, on board flightcontrol system, on board auxiliary navigation system, and disagreementdetection system are isolated from all other onboard electronic systems.10. The apparatus of claim 1, wherein the ground based control system,onboard electronic communication system, on board flight control systemon board auxiliary navigation system, and disagreement detection systemare protected by a firewall.
 11. The apparatus of claim 1, wherein theonboard electronic communication system, on board flight control system,on board auxiliary navigation system, and disagreement detection systemare exclusively programmable by a ground based control system. 12.(canceled)
 13. (canceled)